Slashdot Mirror

As mentioned before, Tripwire does this very well.

The Knoppix Security Tools Distribution provides a free alternative. It includes FTimes [File Topography and Integrity Monitoring on an Enterprise Scale] to record and monitor file signatures. This is a cheap and fairly painless way to keep an eye on those critical files.

SANS Reading Room has some good papers on system baselines. This one discusses using FTimes as part of a Windows box baseline.

Dont forget these, any one will provide the needed/wanted tools for recovery.

Forensic and Incident Response Environment: http://fire.dmzs.com/
Linux Bootable Business Card: http://www.lnx-bbc.org/
Ultimate Boot CD: http://ubcd.sourceforge.net/
Knoppix Security Tools Distribution: http://www.knoppix-std.org/
SystemRescueCd: ahref=http://www.sysresccd.org/rel=url2html-26348h ttp://www.sysresccd.org/>

Knoppix STD sounds like what you want, although I think Knoppix would have chkrootkit on it.

• HELIX and slashdot article on same
• INSERT
• Knoppix STD
• Local Area Security Knoppix and slashdot article on same
• Security LiveCDs article from IBM Developerworks

"Finally enough bandwidth for us all to cut the cord?"

Your a tech of some form I am assuming since your writing a slashdot article, and yet your think bandwidth is the reason large chunks of us are staying away from Wifi. Ahem. Interesting theory.

Try this instead, if I have a cat5 running from my PC to my router I can see the cord.

I know if theres some vampire tap going on. Someone has to physically break into my home (which I can add multiple additional layers of security too to not risk a single point of failure of a dodgy old doorlock) and connect something to it so I have a damn good chance of spotting something that is intercepting my bandwidth.

Wifi, unless I live in a faraday cage I am sending out signals that say "Oh please come and take a look at my network and start using it" to everyone in a short radius from my house or anyone going past who is into wardriving. It then becomes a matter of not IF someone is able to break in but a calculation as to how long it takes even with WEP and MAC addressing alot systems can be breached in 10minutes to 2 hours if they are high traffic. Any old script kiddy can go to Knoppix STD (http://www.knoppix-std.org/) or Remote Auditor (http://new.remote-exploit.org/index.php/Auditor_m ain) and breach every wifi system on the market I can think of, all it takes is time.

If you have the ability, of course, you could get Knoppix-STD http://www.knoppix-std.org/ with snort, and watch the alerts pile up (again, no IP address). Just listen.

I think 12 minutes is high, based on significant, substantial personal experience (i.e. helping people clean up infected machines).

Good news - now I'm waiting for Knoppix STD to release a new version with support for the Intel 2100 wireless stuff.

I use an external firewire enclosure and wipe to nuke drives that I ebay.

There's a self-booting CD diskzapper that looks like it ought to do the trick, though I have not used it.

Other posters mentioned Darik's Boot and Nuke as a floppy-boot solution.

The ultimate boot cd has a number of different disk wipers on it -- and a ton of other useful utilities on it. No self respecting geek should be without a copy.

The Recovery Is Possible bootable CD has a copy of wipe on it.

I wouldn't be suprised if Knoppix-STD had some erasing tool on it too, though I haven't checked.

Anyone know of a bootable image suitable for USB flash sticks?

Fact of the matter is this is just going to happen more and more often. University networks are wide open, first there are computer labs where any one can sit down and pop in a knoppix std cd. then they can fire up ettercap and go to town on everything getting passed on the switch. When campuses use SSL protected systems for grades it is just asking for trouble. Its just a matter of time before Joe Blow will have eery profs passwords. Once that happens it can be tempting to change a couple grades here and there. And grades are nothing compared to the other information that can be obtained, SSN's of the entire campus for instance... Basicly ARP needs to get secure because there is really no way for a college (that has to have an open network to function) can be a safe place to send important data back and forth. Maybe the solution is a private network for profs with the important info on it. Good lesson though.

The usefulness of being able to run, for example, Tripwire from a known clean OS makes me wonder why it isn't standard on KNOPPIX.

I am totally mystified now. Why tripwire a filesystem that can't be changed. that seems like an exercise in futility.

So I googled it ! I came up with a bunch of crap but the one interesting result was knoppix-std. It doesnt even contain tripwire but is a security/analysys tool distro and had "aide" which they describe as tripwire-esque. Anyway it looks pretty cool.

they also missed two I can't live without for security and diagnoses. knoppix-std and insert linux.

Good topic. I wish there were more serious posts so the rest of us could gleam some knowledge from the replies instead of the geeks trying to be funny.

We had a couple people leave work recently and they had some data in the computer that we needed to get ahold of. Since my company requires passwords and restrictive permissions on all Windows systems my team was worried that we might never get the docs off the systems.

A co-worker got out the Knoppix security tools distribution ( http://www.knoppix-std.org/ ) CD and was able to bypass the Windows passwords very easily. And it read the hard drive ignoring windows permissions.

If someone wanted a secure system. The Knoppix STD CD could be a good tool to use. Try and see if you or a trusted friend could get in to your PC.

- Bruzer (trying to be constructive)

For those who may be looking for other stuff then games, another knoppix contains a lot of these games, and a some very usefull tools. Its called Knoppix STD (Security Tool Distribution) http://www.knoppix-std.org/

There is a folder full of forensics tool on the knoppix security tools distro. There are tools like sleuthkit 1.66 which is supposed to be an extension to the coroner's toolkit. Has anyone here used these tools? If so, do you know if the results from these forensics tools are useful and/or admissible in court?

Knoppix-STD is a customized distribution of the Knoppix Live Linux CD. Boot to the CD and you have Knoppix-STD. That would include a customized linux kernel (2.4.21 with ntfs rw, openmosix, and superfreeswan patches), Fluxbox windows manager, incredible hardware detection and hundreds of applications. Boot without the CD and you return to your original operating system. Aside from borrowing power, peripherals and some RAM, Knoppix-STD doesn't touch the host computer.

STD focuses on information security and network management tools. It is meant to be used by both the novice looking to learn more about information security and the security professional looking for another swiss army knife for their tool kit.

Helix is a customized distribution of the Knoppix Live Linux CD. Boot the CD and you have Helix. That includes customized linux kernels (2.4.27 & 2.6.7), Fluxbox window manager, Excellent hardware detection and many applications. Helix has been modified to specifically not touch the host computer and be forensically sound. Helix also has a special Windows autorun side for Incident Response. Helix is now used by SANS for training in Track 8: System Forensics, Investigation and Response.

Helix focuses on Incident Response & Forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and Forensic techniques

Our apologies...

The IBM developerWorks Web site is currently under maintenance.
Please try again later.

Thank you.

Wow... We slashdotted IBM! But to the point: I wonder what is your experience. What is better for system recovery? Standard Knoppix which is a general purpose desktop system meant to be an impressive demonstration tool but lacking many security programs, or some specialised versions like Knoppix STD or Local Area Security which have more tools but are kind of "script kiddie friendly" and look very unprofessional with their Martix themes, leet-speak, "proving no localhost is safe" slogans etc. making them look more like intrusion than recovery tools? Or maybe Morphix is the answer thanks to its ease of customisation and apt-getting new packages on the fly? Do you have any Real World(TM) experience?

A friend brought me his machine to upgrade.
A Frys cheapo Linux special, originally it came with a 30g, 128m ram and Thiz Linux. I Thized the disc straight into the trash and installed Suse 9.0 on it for him when he first got it.

Well, as time went on he realized that his system needed upgrading. So I sent him to the store and he brought back another 128m ram, a 120g drive and Suse 9.1 Pro.

The plan was to have the old doggy 30g as his boot/OS/work drive (hda) and his new 120g as /home (hdb)....

Well, booting up 9.1 does not come up and say
"Hey, I see you have data on your drive already and a new blank drive. Would you like to move it around in anyway before we procede?"

No, Suse just suggests that you wipe everything out and start over. Even if you tell it you want to do an upgrade, it has NO PROVISION what-so-ever to allow you to format the new drive then move your old /home from hda to hdb then reformat hda and partition it up in a useful way.

Ok, so in light of this, I took Damn Small Linux 0.8.2
and booted up. Opened a root terminal, fdisked hdb, formated it for ext3 then moved all of his old /home data from hda to hdb.

It copied EVERYTHING. Hidden files, configurations, email, cookies, bookmarks, music, photos, the whole works.

When it was done I booted into Suse 9.1 pro, did a NEW INSTALLATION and wiped hda clean, installed the OS on it and told it that /home is on hdb1.

I created the same user and password as the old system so Suse looked at the /home on the new 120g drive and asked me if I wanted to change the permissions and ownership over. I said yes.

The install proceded normally to completion.
When it was finished and I rebooted the system, it was identical to the way it was brought to me except that he now has a 120g /home directory instead of the 10gigs he had before.

Damn Small Linux is the very best tool a tech can carry with him. I keep a copies on biz cards in all of my tool boxes and in each of my vehicles.
I don't leave home without it.

I also carry standard Knoppix in case I run into a case where I need k3b on the ailing machine.
I have several other versions of Knoppix I keep handy for various network jobs, like knoppix-std
and a few other network related Knoppix knock offs..

Check out http://www.knoppix-std.org/docs/customize.html or any google results for "customize knoppix."

Btw, I use konqueror for all my browsing. Is firefox REALLY necessary? ;-)

Dear anonymous,
As always, google is your friend.
My learning disabled kid brother doesn't know what data forensics is, but he knows how to use google.
Use it.

http://www.google.com/search?q=knoppix+validation& sourceid=firefox&start=0&start=0&ie=utf-8&oe=utf-8
http://www.google.com/search?q=linux+forensics&sou rceid=firefox&start=0&start=0&ie=utf-8&oe=utf- 8

PDF - KNOPPIX Bootable CD Validation Study for Live Forensic Preview ...

Linux-Forensics.com Home of the Penguin Sleuth Bootable CD

Knoppix security tools distribution Knoppix STD (security tools distribution)

From Australian DoD page:http://www.dsd.gov.au/library/software/flag/
FLAG uses the SleuthKit tool from www.sleuthkit.org to analyse dd images. By putting inode information in the database it is possible to cross-correlate file properties, and simplify the forensic analysis process.

The fact of the matter is that NTFS 5 is the one file system that it appears no one can reliably write to without creating problems, except windows. Most file utils want you to boot to DOS, Knoppix boots you to Linux, and if you're lucky, you can read, but not write.

You should use captive-ntfs on Knoppix, or better yet:

1. Knoppix STD -- Security Tools Sistribution, a customized distribution of the Knoppix Live Linux CD. Boot to the CD and you have Knoppix-STD. That would include a customized linux kernel (2.4.21 with ntfs rw, openmosix, and superfreeswan patches), Fluxbox windows manager, incredible hardware detection and hundreds of applications. Boot without the CD and you return to your original operating system. Aside from borrowing power, peripherals and some RAM, Knoppix-STD doesn't touch the host computer.
2. Local Area Security Linux -- a Live CD distribution with a small footprint. Containing over 200 information security and administration related tools. As well as a full desktop environment and office productivity applications. With such a small footprint L.A.S. Linux can be optionally loaded and run from physical RAM (assuming there is 256MB or more). We currently have 2 different versions of L.A.S. to fit two specific size requirements.
3. dyne:bolic -- a GNU/Linux distribution simply running from a CD, without the need to install anything, able to recognize most of your devices and periferals: sound, video, TV, network cards, firewire, usb devices and more. It is optimized to run on slower computers, turning it into a full media station: the minimum you need is a pentium1 or k5 PC 64Mb RAM and IDE CD-ROM, or a modded XBOX game console -- and if you have more than one, you can easily do clusters.
4. F.I.R.E. -- Forensic and Incident Response Environment Bootable CD, a.k.a. DMZS-Biatchux, a portable bootable cdrom based distribution with the goal of providing an immediate environment to perform forensic analysis, incident response, data recovery, virus scanning and vulnerability assessment.

I hope it helps.

knoppix-std

Most every security tool a network admin (or script kiddie) could want in a convenient iso package.

and see how long before that I use something like Knoppix STD to change my MAC address and get my ass into the network.

Come on, if you're a University, then you've already got fat pipes, and probably let the kids in dorms and the library have unlimited access, so why treat your other students like crap just because they're in the wrong location.

And if you limit their internet access, what kind of education do you think that you're providing them with by limiting the information that they can access?

Hell, and even if you try to, odds are that anybody with half a brain will hack it, or the user with access is going to set up their system as an IP masquerading AP.

If you can boot from the cdrom (if you can't, there is a great bootdisk available that the name escapes me), check out Knoppix-STD. You can boot right from the disc as with other Knoppixes and see if the card will work with their configuration of Kismet, airsnort, and other tools.

If you like it, you can do an image install easily with the included Knoppix install scripts and is easy to maintain with its Debian base.

Since you are into security, perhaps you would be happy getting an STD? Security Tools Distribution, that is. That livecd will likely have any tools on it you need as well as detect your cards without any fuss.

Best of luck.

And for those looking for a custom version of Knoppix with a few different tools built in check out this site:

http://www.knoppix-std.org/

From the site:
STD focuses on information security and network management tools. It is meant to be used by both the novice looking to learn more about information security and the security professional looking for another swiss army knife for their tool kit.

What about this and
this?

They've both been around for some time now.

Is it just that they haven't been written about on ZDNet?

The Knoppix-STD logo is a black cat. Gee, "black cat" sounds just like "black hat"...

Some other good Security LiveCD distros are Knoppix STD and P.H.L.A.K. But I mainly use Knoppix (which also has kismet and nmap), and when I want speed, SLAX is very good.

A lot of the replies to your inquiry mention *nix only tools (Etherape, etc.). If you're stuck with a Win32 PC, a good option for quickly putting many of these tools at your disposal is to run Knoppix-STD. You will need to temporarily leave the Windows environment, but you should feel quite at home within the Knoppix STD (KDE) interface.

dowload the ISO from here it's got most of the tools mentioned here and you don't even need to install it onto your hard disk. It runs a full Linux system from CD.

I can vouch for the win32 build... altouhg I could not check the packets in realtime... (network too fast, computer too slow)

you can try it with Knoppix STD Bootable Linux-ON-CD

with comes with all this:

aimSniff : sniff AIM traffic
driftnet : sniffs for images
dsniff : sniffs for cleartext passwords (thanks Dug)
ethereal 0.10.0 : the standard. includes tethereal
ettercap 0.6.b : sniff on a switched network and more.
filesnarf : grab files out of NFS traffic
mailsnarf : sniff smtp/pop traffic
msgsnarf : sniff aol-im, msn, yahoo-im, irc, icq traffic
ngrep : network grep, a sniffer with grep filter capabilities
tcpdump : the core of it all
urlsnarf : log all urls visited on the wire
webspy : mirror all urls visited by a host in your local browser

Exactly. But this is show is so recockulously bad that it's funny.

One of the tools they plug, though--Knoppix STD--is pretty damn cool.

The first was mentioned in a blog, and uses F-Prot, which is FAIB for home/personal use.

There's also Knoppix STD, a security/vulnerability live CD that includes ClamAV. Doesn't look like they're using the Captive NTFS driver, though, so not sure how well that'll work compared to one that does, like...

BitDefender, which seems to be All That And More. It uses Captive, has ClamAV, and I'm pretty sure it's GPL'd, too. (The company does make commercial/proprietary products too.)

These take care of viruses. I'm not aware of any spyware-removal programs that run under Linux, which is a shame. It really would make it easier to boot from the CD, sip coffee for 15 minutes, then go back to Windows with that fresh feeling...

EduKnoppix
Gnoppix
NordisKnoppix
KnoppMyth
Augustux
Condorux
BitDefender
FeatherLinux
Flonix
Overckockix
Knoppix STD
Sulix

Knoppix-STD perhaps? (for the security part), thought not something you can just put in and let it scan, so a simpler version you could distribute to all family+friends to check their network would rock :)

Ah yes...the pain...the agony...the hurt of trying to get Wing Commander 4 to work on my 486DX box. Those were the days when men were men and gamers had constitutions of steel :-P

I've been using Knoppix-STDin the course of my side gig doing forensic work, and have found it to be indespensible. Especially since it is vitally important that the files on the subject box not be altered in any way, Knoppix is a perfect way to get in and see what little nasties are hiding on a box without even booting up its OS.

I have found the Knoppix STD disc to be of endless utility in conducting forensic examinations. Just haul along Knoppix and a spare HD to stick disc images on and you're set. If you have to conduct an on the spot examination and don't have the luxury of making a drive image, just fire up the hex viewer-I couldn't work with out it. Give a copy a try: The homepage here can fill you in on everything.

Try Knoppix-STD. I haven't really tried everything on it, but it's supposed to be very good for doing security vurinabilities.

Start from there and then roll your own to your liking.

Start from there and then roll your own to your liking.

Have you looked at Partition Image? The NTFS support is still 'experimental', but it can load images over a network from a server. I don't know if it can boot them or not, but it's open-source, so I'm sure you can get some kind of help from the developers toward adding that sort of capability yourself. Then, you'd just need to make a set of bootable CDs that run the partimage client and automatically rewrite the hard drive with the correct image. Shoot -- if you put 2GB of RAM in them, would it be possible to go diskless and load everything onto a RAM Drive? That way, the PC rewipes itself every reboot and you might even get a kick in performance if the disk accesses don't clog the memory bus too badly.

Now, this probably doesn't help because you are looking for a Windows setup, but if you needed Linux, what about rolling your own customized version of Knoppix?

IIRC, the latest versions support network booting from hosted images, and several others have taken Knoppix and tweaked it with various different hardware support and software changes (Overclockix, for example, adds stuff like support for NVidia's NForce2 chipset using NVidia's Linux drivers, which Knoppix won't include because of the licensing terms.)

...though, on second thought. I suppose if you were willing to go through all that trouble, you might just be willing to host the /usr tree read-only from your server -- that would do about the same thing.

From the knoppix homepage:

Possibility to create a persistent homedir with personal data and desktop settings on a memory stick or similar, optional with AES encryption.

Also these options:

• knoppix home=/dev/sda1/knoppix.img Mount loopback file as /home/knoppix
• knoppix home=scan Automatic search for knoppix homedir
• knoppix myconf=/dev/sda1 Load knoppix.sh from /dev/sda1

If you want to bring in the big guns, there's knoppix-std too, with encryption support, etc.

if you think Knoppix is a hacking tool, then you're misguided

and

It denies you root access

Check out Knoppix-STD. STD stands for Security Tools Distribution. Also, when using this distro, root aaccess is achieved by typing 'rootme' at the command line.

Sun Rays are nice, but you can go even cheaper if you get a low-cost PC ( A iDOT Lindows Webstation box, perhaps?), and Knoppix with the Encrypted Persistent Home Directory which you can save on a USB pen drive...

It could, but there are many other, better, bootable distributions for that sort of thing. Three with a security (and thus forensics and recovery) twist that are all more useful in that sort of situation are:

F.I.R.E
knoppix-std
l.a.s.

One thing you can do is to install the Live CD to a hard drive to get a permanant installation. While this may seem counter productive for a Live CD, I've found it to be really useful. I'm currently using the Knoppix Security Tools Distribution as a "desktop" OS... :-) Knoppix 3.2 (what both these distros are based on) includes a really useful script to install the Live CD to the hard drive. It's the easiest way I've found so far to get a Debian testing/unstable system installed and running - with X configured correctly the first time! That, in addition to having tons of great security tools preinstalled and configured makes for one sweet network-workstation-on-steroids.

...of course, I'm in charge of security where I work, so using this as a desktop OS may get you fired from _your_ work... :)

g00r00?

Yup, it's also very similar to knoppix-std (which I ~highly~ recommend), it's just smaller.

The Knoppix STD (Security Tools Distro) ISO is about 612MB. So it would appear this one is much smaller. I'm going to try it out when the traffic dies down.

-cp-

http://www.knoppix-std.org/.

-- PhoneBoy